2010 3rd International Symposium on Applied Sciences in Biomedical and Communication Technologies (ISABEL 2010), 2010
The increasing number of network attacks causes growing problems for network operators and users.... more The increasing number of network attacks causes growing problems for network operators and users. Thus, detecting anomalous traffic is of primary interest in IP networks management. The problem has been faced by many researchers, but still remains an open field, since a general solution has not been found yet. In this paper we want to demonstrate as the performance of
2011 7th International Wireless Communications and Mobile Computing Conference, 2011
The increasing number of network attacks causes growing problems for network operators and users.... more The increasing number of network attacks causes growing problems for network operators and users. Thus, de- tecting anomalous traffic is of primary interest in IP networks management. In this paper we present a novel method for network anomaly detection, based on the idea of discovering Heavy Change (HC) in the distribution of the Heavy Hitters in the network traffic. To
2012 IEEE International Conference on Communications (ICC), 2012
ABSTRACT In the last years CUSUM based algorithms have emerged as a good basis to develop efficie... more ABSTRACT In the last years CUSUM based algorithms have emerged as a good basis to develop efficient systems able to detect anomalies and attacks in the network traffic. Nevertheless, such techniques are still far from providing an ideal solution to the problem, mainly because of the huge number of false alarms that characterizes such approaches. For this reason in this paper we propose a novel detection method based on the combined use of the CUSUM algorithm and the wavelet analysis. The introduction of the wavelet analysis, as shown by the obtained results, allows us to strongly reduce the false alarm rate of the “classical” methods, still retaining excellent performance in the detection of network anomalies.
International Journal of Communication Systems, 2009
In the last years, Service Overlay Networks (SONs) have emerged as a promising means to address s... more In the last years, Service Overlay Networks (SONs) have emerged as a promising means to address some of the issues (e.g. end‐to‐end QoS) affecting the current Internet and to favor the development and deployment of new value‐added Internet services. The deployment of an SON is a capital‐intensive investment, since bandwidth with certain QoS guarantees must be purchased from the individual network domains through bilateral Service Level Agreements. Thus, minimizing the economic cost of the logical end‐to‐end service delivery infrastructure is one of the key objectives for the SON provider. When a SON is aimed at end‐to‐end QoS provisioning, its topology must be designed so as to also satisfy the specific requirements of QoS‐sensitive applications. This paper deals with the problem of planning the SON topology in order to take into account both cost and QoS constraints. More specifically, the paper proposes a set of new algorithms for the design of an optimized SON topology, which min...
AbstractThe increasing number of network attacks causes growing problems for network operators a... more AbstractThe increasing number of network attacks causes growing problems for network operators and users. Thus, de-tecting anomalous traffic is of primary interest in IP networks management. In this paper we address the problem considering a method based on PCA ...
In the last years Skype has gained more and more attention from both the users and the scientific... more In the last years Skype has gained more and more attention from both the users and the scientific community. Namely, the users are interested in its ability to provide a free and reliable way to make phone calls over the Internet, while the scientific community is ...
Proceedings of the 4th International Symposium on Applied Sciences in Biomedical and Communication Technologies - ISABEL '11, 2011
ABSTRACT In the last few years, the number and impact of security attacks over the Internet have ... more ABSTRACT In the last few years, the number and impact of security attacks over the Internet have been continuously increasing. Since it seems impossible to guarantee complete protection to a system by means of the "classical" prevention mechanisms, the use of Intrusion Detection Systems has emerged as a key element in network security. In this paper we address the problem considering a novel technique for detecting network anomalies. Our approach is based on the idea that an anomaly can cause an abrupt change in the quantity of information, associated to a given traffic descriptor. For this reason we propose a novel anomaly detection technique, based on a combined use of information theory and wavelet analysis.
Proceedings of the 6th International Wireless Communications and Mobile Computing Conference, 2010
... of Information Engineering University of Pisa Pisa, Italy s.giordano@iet.unipi.it Michele Pag... more ... of Information Engineering University of Pisa Pisa, Italy s.giordano@iet.unipi.it Michele Pagano Dept. of Information Engineering University of Pisa Pisa, Italy m.pagano@iet.unipi.it Teresa Pepe Dept. of Information Engineering University of Pisa Pisa, Italy t.pepe@iet.unipi.it ...
2013 IEEE Conference on Communications and Network Security (CNS), 2013
ABSTRACT The diffusion of technologies for high speed data transmission over the Internet and the... more ABSTRACT The diffusion of technologies for high speed data transmission over the Internet and the growing employment of new multimedia services require fast and effective techniques for the protection against network attacks. In this paper we present a new approach able to detect at the same time different types of network anomalies. It consists in the simultaneous analysis of several traffic descriptors (aggregated through a sketch to guarantee the scalability of the algorithm) by means of a single vectorial algorithm. In terms of ROC curve, the performance of our multidimensional Intrusion Detection System (IDS) are comparable with the separate application of traditional monodimensional IDSs to all traffic parameters, while reducing the computational time of more than 80%.
2012 IEEE International Conference on Communications (ICC), 2012
ABSTRACT The increasing number of network attacks causes growing problems for network operators a... more ABSTRACT The increasing number of network attacks causes growing problems for network operators and users. Thus, detecting anomalous traffic is of primary interest in IP networks management and many detection techniques, able to promptly reveal and identify network attacks, mainly detecting Heavy Changes (HCs) in the network traffic, have been proposed. Nevertheless, the recent spread of coordinated attacks, that occur in multiple networks simultaneously, makes extremely difficult the detection, using isolated intrusion detection systems that only monitor a limited portion of the Internet. For this reason in this paper we propose a novel distributed architecture that represents a general framework for the detection of network anomalies. The performance analysis, presented in this paper, demonstrates the effectiveness of the proposed architecture.
2010 3rd International Symposium on Applied Sciences in Biomedical and Communication Technologies (ISABEL 2010), 2010
The increasing number of network attacks causes growing problems for network operators and users.... more The increasing number of network attacks causes growing problems for network operators and users. Thus, detecting anomalous traffic is of primary interest in IP networks management. The problem has been faced by many researchers, but still remains an open field, since a general solution has not been found yet. In this paper we want to demonstrate as the performance of
2011 7th International Wireless Communications and Mobile Computing Conference, 2011
The increasing number of network attacks causes growing problems for network operators and users.... more The increasing number of network attacks causes growing problems for network operators and users. Thus, de- tecting anomalous traffic is of primary interest in IP networks management. In this paper we present a novel method for network anomaly detection, based on the idea of discovering Heavy Change (HC) in the distribution of the Heavy Hitters in the network traffic. To
2012 IEEE International Conference on Communications (ICC), 2012
ABSTRACT In the last years CUSUM based algorithms have emerged as a good basis to develop efficie... more ABSTRACT In the last years CUSUM based algorithms have emerged as a good basis to develop efficient systems able to detect anomalies and attacks in the network traffic. Nevertheless, such techniques are still far from providing an ideal solution to the problem, mainly because of the huge number of false alarms that characterizes such approaches. For this reason in this paper we propose a novel detection method based on the combined use of the CUSUM algorithm and the wavelet analysis. The introduction of the wavelet analysis, as shown by the obtained results, allows us to strongly reduce the false alarm rate of the “classical” methods, still retaining excellent performance in the detection of network anomalies.
International Journal of Communication Systems, 2009
In the last years, Service Overlay Networks (SONs) have emerged as a promising means to address s... more In the last years, Service Overlay Networks (SONs) have emerged as a promising means to address some of the issues (e.g. end‐to‐end QoS) affecting the current Internet and to favor the development and deployment of new value‐added Internet services. The deployment of an SON is a capital‐intensive investment, since bandwidth with certain QoS guarantees must be purchased from the individual network domains through bilateral Service Level Agreements. Thus, minimizing the economic cost of the logical end‐to‐end service delivery infrastructure is one of the key objectives for the SON provider. When a SON is aimed at end‐to‐end QoS provisioning, its topology must be designed so as to also satisfy the specific requirements of QoS‐sensitive applications. This paper deals with the problem of planning the SON topology in order to take into account both cost and QoS constraints. More specifically, the paper proposes a set of new algorithms for the design of an optimized SON topology, which min...
AbstractThe increasing number of network attacks causes growing problems for network operators a... more AbstractThe increasing number of network attacks causes growing problems for network operators and users. Thus, de-tecting anomalous traffic is of primary interest in IP networks management. In this paper we address the problem considering a method based on PCA ...
In the last years Skype has gained more and more attention from both the users and the scientific... more In the last years Skype has gained more and more attention from both the users and the scientific community. Namely, the users are interested in its ability to provide a free and reliable way to make phone calls over the Internet, while the scientific community is ...
Proceedings of the 4th International Symposium on Applied Sciences in Biomedical and Communication Technologies - ISABEL '11, 2011
ABSTRACT In the last few years, the number and impact of security attacks over the Internet have ... more ABSTRACT In the last few years, the number and impact of security attacks over the Internet have been continuously increasing. Since it seems impossible to guarantee complete protection to a system by means of the "classical" prevention mechanisms, the use of Intrusion Detection Systems has emerged as a key element in network security. In this paper we address the problem considering a novel technique for detecting network anomalies. Our approach is based on the idea that an anomaly can cause an abrupt change in the quantity of information, associated to a given traffic descriptor. For this reason we propose a novel anomaly detection technique, based on a combined use of information theory and wavelet analysis.
Proceedings of the 6th International Wireless Communications and Mobile Computing Conference, 2010
... of Information Engineering University of Pisa Pisa, Italy s.giordano@iet.unipi.it Michele Pag... more ... of Information Engineering University of Pisa Pisa, Italy s.giordano@iet.unipi.it Michele Pagano Dept. of Information Engineering University of Pisa Pisa, Italy m.pagano@iet.unipi.it Teresa Pepe Dept. of Information Engineering University of Pisa Pisa, Italy t.pepe@iet.unipi.it ...
2013 IEEE Conference on Communications and Network Security (CNS), 2013
ABSTRACT The diffusion of technologies for high speed data transmission over the Internet and the... more ABSTRACT The diffusion of technologies for high speed data transmission over the Internet and the growing employment of new multimedia services require fast and effective techniques for the protection against network attacks. In this paper we present a new approach able to detect at the same time different types of network anomalies. It consists in the simultaneous analysis of several traffic descriptors (aggregated through a sketch to guarantee the scalability of the algorithm) by means of a single vectorial algorithm. In terms of ROC curve, the performance of our multidimensional Intrusion Detection System (IDS) are comparable with the separate application of traditional monodimensional IDSs to all traffic parameters, while reducing the computational time of more than 80%.
2012 IEEE International Conference on Communications (ICC), 2012
ABSTRACT The increasing number of network attacks causes growing problems for network operators a... more ABSTRACT The increasing number of network attacks causes growing problems for network operators and users. Thus, detecting anomalous traffic is of primary interest in IP networks management and many detection techniques, able to promptly reveal and identify network attacks, mainly detecting Heavy Changes (HCs) in the network traffic, have been proposed. Nevertheless, the recent spread of coordinated attacks, that occur in multiple networks simultaneously, makes extremely difficult the detection, using isolated intrusion detection systems that only monitor a limited portion of the Internet. For this reason in this paper we propose a novel distributed architecture that represents a general framework for the detection of network anomalies. The performance analysis, presented in this paper, demonstrates the effectiveness of the proposed architecture.
Uploads